# IdleProvider overstates balanceUnderlying() and understates calcShares()

Derby's IdleProvider used Idle's tokenPrice() which excludes performance fees, overstating balanceUnderlying() and understating calcShares(), skewing vault rebalancing and performance metrics.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: hyh
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/206
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** IdleProvider.sol exchangeRate() / Vault rebalancing
**Root cause:** exchangeRate() calls Idle tokenPrice() which excludes user performance fees instead of tokenPriceWithFee(), so share price is overstated and shares needed understated.
**Steps:**
1. Read IdleProvider.exchangeRate() returning IIdle(_iToken).tokenPrice()
2. Note Idle docs: tokenPrice() excludes performance fees; tokenPriceWithFee(user) includes them
3. Trace balanceUnderlying() = balanceShares*price/10**decimals using this inflated price
4. Trace calcShares() = amount*10**decimals/price using inflated price
5. Observe Vault.rebalanceCheckProtocols and Vault.price() consume these values
**How found:** Code review comparing Idle's tokenPrice() vs tokenPriceWithFee() semantics against how Derby's provider uses the rate for balance and share calculations.
**Exploitation:** No direct theft; when Idle strategy has profit and fees are deducted on withdrawal, rebalancing deposits/withdrawals are less than requested, biasing distribution and inflating Derby's internal performance metric for Idle pools over time.
**Insight:** When integrating a yield protocol, check whether its price oracle method is fee-inclusive; protocols often expose separate tokenPrice() and tokenPriceWithFee(user) where only the latter matches actual redeemable amounts.